THE THREAT LANDSCAPE FROM CYBERCRIME TO CYBER-WAR David Emm Global Research and Analysis Team

CONTENTS 2 What kind of malware? Who’s writing it and why? What do we do about it? 3 2 1

THE SCALE OF THE THREAT 1 NEW VIRUS EVERY HOUR NEW VIRUS EVERY MINUTE NEW VIRUS EVERY SECOND ,000 NEW SAMPLES EVERY DAY 2013

THE GROWING MALWARE THREAT

HOW MALWARE SPREADS 5 People Technology … and how people use it

VULNERABILITIES AND EXPLOITS 6

7

‘DRIVE-BY DOWNLOADS’ 8

SOCIAL NETWORKS 9

10

REMOVABLE MEDIA 11

DIGITAL CERTIFICATES 12

SOPHISTICATED THREATS 13 Code obfuscation Rootkits Hide changes made by malware Installed files Running processes Registry changes Advanced technologies £k1_ s”+gr!pl;7&

NEW TACTICS 14 All kinds of information Not just bank data Steal everything! Sophisticated Carefully selected targets Well-defined aims Targeted attacks

0.1 % 9.9 % 90 % THE NATURE OF THE THREAT Traditional cybercrime Targeted threats to organisations Cyber-weapons

POLITICAL, SOCIAL OR ECONOMIC PROTEST

THEFT OF SENSITIVE DATA “There’s no such thing as ‘secure’ any more. The most sophisticated adversaries are going to go unnoticed on our networks. We have to build our systems on the assumption that adversaries will get in. We have to, again, assume that all the components of our system are not safe, and make sure we’re adjusting accordingly.” Debora Plunkett, NSA Director Quoted in “NSA Switches to Assuming Security Has Always Been Compromised” “There’s no such thing as ‘secure’ any more. The most sophisticated adversaries are going to go unnoticed on our networks. We have to build our systems on the assumption that adversaries will get in. We have to, again, assume that all the components of our system are not safe, and make sure we’re adjusting accordingly.” Debora Plunkett, NSA Director Quoted in “NSA Switches to Assuming Security Has Always Been Compromised”

CYBER-WEAPONS “… cyber weapons are: a) effective; b) much cheaper than traditional weapons; c) difficult to detect; d) difficult to attribute to a particular attacker …; e) difficult to protect against …; f) can be replicated at no extra cost. What’s more, the seemingly harmless nature of these weapons means their owners have few qualms about unleashing them, with little thought for the consequences. Eugene Kaspersky June “… cyber weapons are: a) effective; b) much cheaper than traditional weapons; c) difficult to detect; d) difficult to attribute to a particular attacker …; e) difficult to protect against …; f) can be replicated at no extra cost. What’s more, the seemingly harmless nature of these weapons means their owners have few qualms about unleashing them, with little thought for the consequences. Eugene Kaspersky June

CYBER-WEAPONS: NUMBER OF VICTIMS OVER 100K OVER 300K 2,500 10K K StuxnetGaussFlameDuquminiFlame Known number of incidentsAdditional number of incidents (approximate) 300K 100K 10K 1K Source: Kaspersky Lab

TARGETED ATTACKS 20 Google RSA Lockheed Martin Sony Comodo DigiNotar Some of the victims: Saudi Aramco LinkedIn Adobe Syrian Ministry of Foreign Affairs The New York Times Tibetan activitists

21

MOBILE MALWARE 22 10,000,509 unique installation packs

WHY TARGET MOBILE DEVICES? Mobile devices contain lots of interesting data: SMS messages Business Business contactsPersonal photosGPS co-ordinatesBanking credentialsInstalled appsCalendar The evolving threat landscape23

PLATFORMS 24

WHAT SORT OF MALWARE? 25

THE GEOGRAPHY OF MOBILE MALWARE 26

MOBILE DEVICES AND TARGETED ATTACKS 27

WHAT DO WE DO ABOUT IT? 28

WHAT DO WE DO ABOUT IT? 29

WHAT DO WE DO ABOUT IT? 30

QUESTIONS David Emm Global Research and Analysis Team